docs: sync PRs #795-#871 to aeon docs

[aaronjmars]

Syncs the merged aeonfun/aeon PRs that had gone undocumented on the downstream doc surfaces. The docs-sync ledger was stale at #792, but prior in-repo sync PRs (#793, #804, #807, #825, #858, #861) and the website changelog had already carried most of the window; this catches the stragglers the true watermark (website changelog, #864) had left behind.

PR window

Undocumented-everywhere set: #795, #863, #865, #866, #868, #869, #871 (7 PRs: 6 signal, 1 noise).

Surfaces changed (this repo)

• CHANGELOG.md [Unreleased]
  • Added — taskmarket-delegate skill (feat(skills): add taskmarket-delegate skill (browse/create/submit TaskMarket tasks) #865, catalog 74 -> 75), hunter-22 skill (hunter-22: bounty discovery with a one-tap audit handoff to vuln-scanner #864, catalog 73 -> 74; backfilled — was on the website changelog but not this repo's), you-web-search skill (feat: add optional You.com web search integration #795, previously undocumented), Finance District ecosystem row (docs: add Finance District to ECOSYSTEM.md #869)
  • Changed — vuln-scanner runs a repo's own cargo-fuzz harnesses in scan arm A (vuln-scanner: fuzz targets a repo already ships (cargo-fuzz) #863, vuln-scanner: stage cargo-fuzz toolchain + widen sandbox grant #868)
  • Fixed — bin/add-skill install for the standard skills/<slug>/SKILL.md layout (fix(add-skill): enumerate and install skills under skills/ (was broken for all repos) #866)
  • Security — ALL_SECRETS allowlist, not toJSON(secrets) (fix(ci): build ALL_SECRETS from an explicit allowlist, not toJSON(secrets) #819, backfilled — was on the website changelog but not this repo's; the fix that took two public instances dark Jul 30)
  • Maintenance — nanoid advisory patch (fix(deps): patch nanoid security advisories #871)
• .claude/skills/aeon/references/secrets.md — added YDC_API_KEY (you-web-search) and TASKMARKET_API_KEY (taskmarket-delegate) to the skill-specific keys table

Not touched (already correct)

• README + docs/skill-packs.md exact skill counts already show 75 (each new-skill PR regenerated them on merge; validate-readme-catalog.mjs passes: 6 packs / 75 skills). The 60+ marketing floor (docs: express headline skill count as a stable 60+ floor #859) is left as-is per convention.
• docs/ECOSYSTEM.md already carries Finance District (docs: add Finance District to ECOSYSTEM.md #869 merged here).

Noise bundled as maintenance

• fix(deps): patch nanoid security advisories #871 — fix(deps): patch nanoid security advisories (dashboard lockfile-only)

Watermark

New sync watermark: #871 (undocumented set through the highest merged PR).